Incidents — from report to closure
An incident closed quickly is an incident that repeats. That is why the lifecycle here is guarded at every turn: Reported → Investigating → Resolved → Closed, each transition with its own condition.
A report is not an investigation
An incident is born reported, and moves to investigation only through an explicit act: "Start investigation". That act automatically creates the investigation record in the name of whoever pressed it — so there is no incident "under investigation" without a real investigation carrying an investigator's name.
The board columns you add yourself are investigation stages; a card enters them only through the gate above, so a report never jumps over triage.
Root cause — a conditional requirement
This is the rule users ask about most:
| Incident severity | Resolving without a recorded root cause |
|---|---|
| High or critical | Blocked — the system refuses |
| Low or medium | Allowed after an explicit warning |
Because a serious incident without a root cause means you do not know why it happened — and you will pay for it again. Minor incidents, on the other hand, should not halt operations, so a warning that documents your choice is enough.
Closing requires the actions to be closed
An incident does not close while it has an unfinished corrective action — and the system does not look at your column names but at the actual state, so an action parked in a column you added counts as open.
If your actions are completed but not yet verified, closing passes after a warning: verification may legitimately follow closure, but you must know what you are skipping.
Impact is recorded, not estimated
Injuries, fatalities, asset and location damages and the estimated loss are recorded on the incident — and these are not decorative fields: your indicators are built from them, and the "incidents and their impact" section of the management-review minutes fills itself from them.
The effect on your compliance
Clause 10.2 (nonconformity and corrective action) reads your stale open incidents: a pile of incidents open past a reasonable age turns the clause red. A clean closure — investigation, then cause, then a verified action — is what turns it green.
Resume, not reopen
A resolved incident returns to investigation through the ordinary "Resume" action. "Reopen" is reserved for closed incidents alone and clears the closure date after a warning — because disturbing a sealed record is an event that deserves a trace.